See, so I’ve never seen the purpose of NTFS streams. In a cyber security course, I was warned to look out for Alternate Data Streams, but got an unsatisfactory answer when I prodded the instructor for more (it was apparent that didn’t have anything beyond a surface level understanding of them).

Your link was informative in grasping what they are, but I still don’t think I’m clear on how they’re used in the “real world”. Like, what (and how) would one use them for a legitimate purpose?